Convert escaped-json to json

Elastic Stack Logstash
1

Hi,

One field in an incoming message is escaped-json-string. I need to convert it to JSON in logstash. What's the best way to do this?

I've tried the JSON filter as below:
json {
source => "message"
add_field => { "filtered" => "true" }
}

The above didn't work for me.

Here is a sample input:

{
"candidateID" : "12345",
"category" : "Entry Level",
"message" : "{\r\n "firstName": "John",\r\n "lastName": "Smith",\r\n "age": 25,\r\n "address":\r\n {\r\n "streetAddress": "21 2nd Street",\r\n "city": "New York",\r\n "state": "NY",\r\n "postalCode": "10021"\r\n },\r\n "phoneNumber":\r\n [\r\n {\r\n "type": "home",\r\n "number": "212 555-1234"\r\n },\r\n {\r\n "type": "fax",\r\n "number": "646 555-4567"\r\n }\r\n ]\r\n }"

}

I've explored json filter and json_lines. I tried the codec too. No luck yet. How do I convert the escaped json string in "message" field back to json before persisting in ElasticSearch?

Your response is appreciated.

1 Like
2

Answering my own question as I found a solution:
I had to remove the \r, \n in mutate filter (gsub) before pushing the field through json filter.

1 Like
3

What error did you get?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.